User Guide for Access Control - GTG CRM

1. Access Permissions

Step 1: Log in to GTG CRM

Log in to your GTG CRM account.

Step 2: Open the Settings Menu

Look at the menu on the left , scroll to the bottom and click on Settings .

Step 3: Select Permissions

In the Settings menu, click on Permissions .

2. View Default Roles

GTG CRM provides 3 default roles :

Administrator

Marketing Manager

Marketing Staff

3. Create a New Role

Step 1: Click "Add role"

In the upper right corner of the screen , click the "Add role" button.

Step 2: Name the Role

Enter a name for the new role (e.g., "Sales", "Support", "Warehouse").

Step 3: Add a Description (Optional)

Provide a brief description of this role for easier management later.

Example: - Name: Sales - Description: Sales representative, manages customers and orders

4. Customize Permissions

Rights Structure

Each module has its own set of permissions:

 Module ├── Create (Tạo mới) ├── View (Xem) ├── Update (Cập nhật) ├── Delete (Xóa) └── Các quyền đặc biệt khác Enable/Disable Permissions Module ├── Create (Tạo mới) ├── View (Xem) ├── Update (Cập nhật) ├── Delete (Xóa) └── Các quyền đặc biệt khác

Use the toggle switch to enable/disable each permission: - Toggle ON : Allow - Toggle OFF : Disallow

Module-based permissions

Automation Workdraw

Landing Page

Marketing

printer

Email & Messaging

Billing

Settings / Workspace

Save Role

After you've finished customizing, click "Save" to create the role.

5. Assign Roles to Users

Step 1: Open "User Management"

The "User List" here contains all users in the workspace.

Step 2: Find the User

Find the user you want to assign permissions to in the list.

Step 3: Choose a Role

In the "Roles" column, click the dropdown to open the list of roles.

Step 4: Assign Roles

Select the appropriate role from the dropdown. The role will be assigned immediately.

Step 5: Confirmation

Verify that the assigned roles are correct.

6. Role Management

Edit Roles

1. Click on the role you want to edit.
2. Change of authority
3. Click Save

Delete Role

1. Click on the role you want to delete.
2. Click Delete role
3. Confirm deletion

Note : Default roles (Administrator, Marketing Manager, Marketing Staff) cannot be deleted.

Practical Example

Example 1: Creating the "Sales" Role

Objective : Sales staff need to manage customers, send text messages, and send emails.

Permission granted : - CRM: CRM_VIEW_ALL_CONTACT , CRM_OBJECT_VIEW - Messaging: All - Email: All - Automation: AUTOMATION_WORKFLOW_CREATE , View, Update - Landing Page: Create, Update, Publish, View - Marketing: View only

Permissions NOT granted : - AUTOMATION_WORKFLOW_DELETE - Delete Landing Page - Manage Marketing Campaigns

Example 2: Creating the "Support" Role

Objective : Support staff only need to view messages and respond to customers.

Permission level : - Messaging: View, Reply - CRM: CRM_VIEW_ALL_CONTACT , CRM_OBJECT_VIEW - Email: View only

Rights NOT granted : - All other rights

Example 3: Creating the "Finance" Role

Objective : Accounting for invoices and payment methods.

Permissions granted : - BILLING_VIEW_INVOICE — View invoices - BILLING_ADD_PAYMENT_METHOD — Add a payment method - WORKSPACE_VIEW_BILLING_MEMBER — View billing information

7. Convention A - Domain Name DOMAIN_ACTION_OBJECT (New 5/2026)

All permission names in GTG CRM are standardized according to Convention A — DOMAIN_ACTION_OBJECT .

How to read the name of Convention A

 BILLING_VIEW_INVOICE │ │ │ │ │ └── Object: INVOICE (đối tượng: hóa đơn) │ └── Action: VIEW (hành động: xem) └── Domain: BILLING (lĩnh vực: thanh toán) Domain Name Table BILLING_VIEW_INVOICE │ │ │ │ │ └── Object: INVOICE (đối tượng: hóa đơn) │ └── Action: VIEW (hành động: xem) └── Domain: BILLING (lĩnh vực: thanh toán)

Why the name change?

Previously, permission names were inconsistent: SEND_EMAIL , CREATE_LANDING_PAGE , VIEW_BILLING — making them difficult to find and audit when workspaces had multiple permissions.

Convention A addresses this by: - ​​Grouping by Domain → searching for BILLING_ immediately reveals all billing permissions - Consistent Actions → VIEW always means view, CREATE always means create - Easy Auditing → typing the domain name filters out all related permission groups

8. Administrator Automatically Accesses Settings

Administrators will be assigned new, individual WORKSPACE_* permissions that can be accessed through the Settings menu.

Administrators automatically have full Settings permissions — no further assignment is needed.

Important Note

Best Practices

1. The principle of least authority : Grant only the authority necessary for that role.
2. Periodic Review : Re-examine employee permissions when employees change positions.
3. Backup before deletion : Record the role configuration before deleting.
4. Permission test : Log in using the assigned account to verify the permissions.

Security

• Only administrators are authorized to manage permissions.
• Do not share the Administrator account.
• All permission changes are logged automatically.

FAQ

Q: Is it possible to assign multiple roles to one person?

A : Currently, each user can only be assigned one role.

Q: Will the new role have an immediate impact?

A : Yes, the role is applied immediately after assignment.

Q: Is it possible to roll back permissions?

A : The role can be reassigned at any time.

Q: Where is the rights name under Convention A displayed?

A : In the Settings → Permissions interface, each permission toggle displays a name according to Convention A for easy lookup.

Summary

With the Permission Management feature in GTG CRM:

• Expand the safety team - each person does only their assigned task.
• Control access to critical data.
• Convention A - a standardized rights name, easy to audit by domain.
• Administrator automatically has Settings - no more misconfiguration
• Operate professionally like a large enterprise.